| शीर्षक | https://github.com/simstudioai https://github.com/simstudioai/sim ≤ v0.5.21 Authentication Bypass by Primary Weakness |
|---|
| विवरण | When deploying using the official Docker deployment method, the key authentication key has a default value. During our security analysis of the Sim application, we identified a critical authentication bypass vulnerability originating from the internal authorization logic implemented in internal.ts. This module is responsible for securing internal API routes (e.g., cron endpoints, internal tasks, server-side system functions). However, the authentication logic contains an overly permissive condition: when the expected internal secret is missing, undefined, or empty, the verification step does not reject the request as intended. Attackers can exploit this vulnerability to bypass authentication and perform operations that could be harmful to the system. |
|---|
| स्रोत | ⚠️ https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2 |
|---|
| उपयोगकर्ता | 28Hus (UID 92415) |
|---|
| सबमिशन | 09/12/2025 03:13 PM (10 महीनों पहले) |
|---|
| संयम | 25/12/2025 05:18 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338430 [simstudioai sim तक 0.5.27 CRON Secret internal.ts INTERNAL_API_SECRET कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|